CVE-2026-27118: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27118 is a cache poisoning vulnerability in the @sveltejs/adapter-vercel npm package affecting all versions prior to 6.3.2. An internal query parameter designed for Incremental Static Regeneration (ISR) is improperly exposed on all routes, enabling an attacker to cause authenticated, user-specific responses to be cached and subsequently served to other users. The vulnerability was published on February 18, 2026, and assigned a CVSS v4 base score of 5.3 (Medium) (GitHub Advisory, SvelteKit Advisory).

The root cause is classified as CWE-346 (Origin Validation Error) — the adapter fails to properly restrict an internal ISR query parameter, making it accessible on all application routes rather than only internal/ISR-specific ones. An attacker can craft a URL containing this parameter and trick an authenticated victim into visiting it; the server then caches the victim's personalized response and serves it to subsequent unauthenticated or different users who request the same cached resource. Exploitation requires no privileges on the attacker's part but does require passive user interaction (the victim must follow an attacker-controlled link while authenticated) (GitHub Advisory, SvelteKit Advisory).

Successful exploitation results in a confidentiality breach where sensitive, user-specific data (e.g., session content, personal information rendered in page responses) is cached at the CDN/edge layer and exposed to other users. There is no direct integrity or availability impact. The scope is limited to the vulnerable system's confidentiality, but the exposure can affect any authenticated user of a SvelteKit application deployed via the Vercel adapter, potentially leaking personal or session-bound data at scale (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.019% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Vercel's WAF provides a compensating control for existing deployments, reducing immediate risk (GitHub Advisory, SvelteKit Advisory).

1. Reconnaissance: Identify a target web application built with SvelteKit and deployed on Vercel using @sveltejs/adapter-vercel versions prior to 6.3.2. This can be inferred from HTTP response headers (e.g., x-vercel-* headers) or public deployment metadata.
2. Identify the ISR query parameter: Determine the internal ISR query parameter name used by the adapter (e.g., a parameter like __prerender_bypass or similar internal token exposed on all routes).
3. Craft a malicious URL: Construct a URL targeting a route that returns user-specific content (e.g., a profile page or dashboard), appending the ISR query parameter to trigger cache storage: https://target.example.com/profile?<isr_param>=<value>.
4. Deliver the link to an authenticated victim: Send the crafted URL to a logged-in user via phishing, social engineering, or embedded link, causing the victim's authenticated, personalized response to be cached at the edge.
5. Retrieve cached sensitive data: Request the same URL without authentication (or as a different user) to receive the cached response containing the victim's sensitive data (GitHub Advisory, SvelteKit Advisory).

• Network: HTTP requests to application routes containing unexpected ISR-related internal query parameters (e.g., parameters not normally present in legitimate user traffic); repeated requests to the same URL with such parameters from different source IPs.
• Logs: Edge/CDN cache logs showing authenticated responses (containing Set-Cookie or user-specific content) being stored and served as cache hits to subsequent requestors; Vercel access logs with unusual query parameter patterns on non-ISR routes.
• Application: Vercel WAF alerts triggered by requests matching ISR parameter patterns on non-ISR routes (GitHub Advisory).

Upgrade @sveltejs/adapter-vercel to version 6.3.2 or later, which restricts the ISR query parameter to its intended internal use and prevents it from being accessible on all routes. For deployments that cannot immediately upgrade, Vercel's WAF provides a compensating control that blocks exploitation of this vulnerability. No additional configuration-based workarounds have been documented (GitHub Advisory, SvelteKit Advisory).

The vulnerability received coverage from security news outlets including GBHackers and CyberPress, which highlighted the cache deception risk for SvelteKit/Vercel deployments and the potential for user data exposure. The Hacker News weekly recap also referenced the vulnerability. Community reaction was generally measured given the medium severity and the existing WAF mitigation from Vercel (GBHackers, CyberPress).